aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAlexey Dobriyan <adobriyan@sw.ru>2007-03-29 12:22:40 -0700
committerGreg Kroah-Hartman <gregkh@suse.de>2007-04-06 03:43:14 -0700
commit4870b7bf2ed1ffb316bd57ed8172e384ab186d6a (patch)
tree4deb448944af42bce60212a0e4a5d5ee03a1a1db
parentcb8b4fce39de35071349352c004d930bf9266624 (diff)
downloadlinux-linaro-stable-4870b7bf2ed1ffb316bd57ed8172e384ab186d6a.tar.gz
NET: Fix sock_attach_fd() failure in sys_accept()
[NET]: Correct accept(2) recovery after sock_attach_fd() * d_alloc() in sock_attach_fd() fails leaving ->f_dentry of new file NULL * bail out to out_fd label, doing fput()/__fput() on new file * but __fput() assumes valid ->f_dentry and dereferences it Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-rw-r--r--net/socket.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/net/socket.c b/net/socket.c
index 4e396312f8d5..afb6085827ca 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1368,7 +1368,7 @@ asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr,
err = sock_attach_fd(newsock, newfile);
if (err < 0)
- goto out_fd;
+ goto out_fd_simple;
err = security_socket_accept(sock, newsock);
if (err)
@@ -1401,6 +1401,11 @@ out_put:
fput_light(sock->file, fput_needed);
out:
return err;
+out_fd_simple:
+ sock_release(newsock);
+ put_filp(newfile);
+ put_unused_fd(newfd);
+ goto out_put;
out_fd:
fput(newfile);
put_unused_fd(newfd);